Digital certificates have become an integral part of our lives. We use them for digital signatures, for encrypting network traffic (for example, when using a web browser), for encrypting emails with S/MIME or PGP (Pretty Good Privacy), and when using smart cards (bank cards, electronic ID cards, etc.).
But what exactly are digital certificates, and how do they work?
Digital certificates are electronic documents that verify the authenticity of individuals, companies, websites, or computers in the digital world. They certify that a public key belongs to a specific entity. They are issued by trusted institutions known as certification authorities (CAs).
The responsibilities of a certification authority (CA) include, among other things:
- Processing certificate requests: Verify the applicant's identity, generate, sign, and issue the certificate
- provide your own public key
- Maintain and publish a list of certificates that are no longer trusted (CRL = Certificate Revocation List)
- Operating an OCSP (Online Certificate Status Protocol) Responder Server
Further information, as well as a list of German certification authorities (CAs) that are recognized by the EU as trustworthy, is available here.
Certificate Data
In addition to the owner's name (an individual or another entity), certificates contain other information, such as:
- the Certification Authority (CA)
- the validity period (from-to dates)
- a serial number
- the owner's public key
- the certification authority's signature
- the purpose of the payment
- Additional information about the owner
When you access a website with a certificate in a web browser (indicated by the padlock to the left of the URL), you can also view all the certificate's details there (example of https://itsonix.eu). You can also export the certificate.
How does certificate verification work for websites?
- A website is opened in the browser
- The server presents its certificate and public key
- The browser reads the certificate issuer and verifies its trustworthiness
- The browser maintains an internal whitelist of certification authorities (CAs) under „Trusted Root Certification Authorities“ and verifies the issuer against this list.
- If the verification is successful, the certificate will be certified as authentic
- The certificate's validity is checked: The certificate must not have expired or been revoked by the certification authority before the end of its validity period (CRL).
- The web server's address is verified: Does the web server's address specified in the certificate match the address entered in the browser's address bar?
- If all of these conditions are met, the browser begins establishing an SSL connection with the server
If not all conditions are met—for example, because the certificate has expired or comes from an untrusted source—the browser will alert you. However, you can manually verify and accept the certificate through a dialog box. As a general rule, you should not agree to this; if you do, you should exercise caution and under no circumstances disclose any personal information. You may have fallen victim to a phishing attack. This means the website you’re visiting may not actually be from the bank, but from hackers.
What steps must be taken to obtain a certificate?
Anyone (such as a website owner) who needs a certificate must request it from a certification authority (CA) via a CSR (Certificate Signing Request). To do so, the following steps are required:
- Generate a key pair (a private key and a public key)—the private key must be kept secure and must not be disclosed under any circumstances
- Create a CSR file; this is the electronic application form. In addition to the owner's identity (application data), it also contains the owner's public key
- handle the so-called Proof-of-Possession (PoP) (proof of ownership of the corresponding private key)—in the form of a self-signature on the application
- Send the CSR to the registration authority (RA) for verification
- The Registration Authority (RA) reviews the application and, if approved, forwards it to the Certification Authority (CA)
- The certification authority (CA) issues a new public certificate to the applicant by signing a corresponding X.509 data structure with its private key and sends it to the applicant
What is a certificate chain?
A certificate chain (also known as a certification path) is a sequence of digital certificates. Each certificate is signed by the „higher-level“ certificate.
Certificate chains typically consist of three certificates:
- the actual SSL certificate (short validity period of 3 months to 2 years)
- an intermediate certificate (medium validity period)
- the root certificate (long validity period; typically decades)
Certificate chains are necessary because, on the one hand, it is very time-consuming to replace trusted root certificates (e.g., in the operating system or web browser), and, on the other hand, it must be easy to revoke a certificate or restrict its validity.
Root certificates (or the certification authority (CA) that stores them) are usually subject to special security measures (access controls, the dual-control principle, offline storage, and self-destruction mechanisms). This is so important because if the private key is lost, all SSL certificates based on that root certificate automatically become untrustworthy. The replacement of a root certificate and intermediate certificates takes place as part of so-called „key ceremonies“ and is subject to strict security protocols.
Structure of Certificates
Over the years, various formats of certificates have emerged in response to differing requirements. The most important of these are:
- X.509: is the best-known and most widely used standard for digital certificates and is used, among other things, for:
- Secure communication with websites via SSL/TLS
- Encrypting Emails with S/MIME
- VPN
- ISO 7816: is used for Card Verifiable Certificates (CVC) that are embedded in smart cards to verify the identity of individuals or organizations
- EMV standard: stands for Europay, Mastercard, and Visa, and is an international standard for chip cards used in payment transactions
Example of an X.509 certificate:
Conclusion
Today, digital certificates are essential for ensuring the identity and integrity of data and communication partners in the digital space. Without these certificates, it would be nearly impossible to establish trusted relationships and exchange sensitive information online. Digital certificates are indispensable, particularly in security-critical areas such as e-banking or e-commerce, to ensure the security of transactions and information.
In addition, digital certificates play an important role in many new and emerging technologies and applications (e.g., e-government, smart homes, connected cars). This also involves the authentication and authorization of devices and systems. Digital certificates make it possible to establish secure and reliable connections and prevent tampering and attacks.
Overall, digital certificates are an indispensable part of our digital infrastructure and will likely become increasingly important as technological change continues to advance. Their complexity, varying formats, and regular updates and renewals will continue to pose challenges in the future.
